Previously, the System.ExpressionFilter did not include suppression – today it does!

What this means is, we can now count the number of passes through a condition detection, and it will only pass data to the next module when the MatchCount value exceeds the configuration provided.

It doesn’t sound like a big deal really – but it is. I’ve had cases where I needed to count condition passes, and the only way to do it before was to include a consolidation module. This was not fun and it turned out to be a lot more work than was necessary – and it was confusing to the customer when they looked at the code.

What I do not like so much is the fact that Microsoft doesn’t expose this new configuration in their base monitoring at this time. For example, it’s not possible to override the match count for a service monitor that you created using the service monitoring template – or even interval for that matter. To me, it doesn’t make sense to introduce a new configuration element without providing a way to override it – especially a valuable configuration such as this.

The default monitoring for Windows services (at this time) is to sample every 30 seconds and exceed a match count of 2. This equates to a state change within 60 seconds of service downtime.

What I am providing here is a Windows service monitoring VSAE fragment that will allow you to override both the interval as well as the match count. I’ve also included an additional state value to account for service not found conditions. I added this condition because sometimes a pack needs to take into account upgrade scenarios where a service name changes – you don’t want an alert on a service that had been renamed due to an upgrade!

By the way, MatchCount has nothing to do with service monitoring – it’s a part of the expression filter, and can be used anywhere. This is just a working example of how you can use it in a custom service monitor type.

Now you can implement new unit monitors that use this monitor type, and extend to your operators the ability to override interval and match count. You might want to replace "Example" with your company name before implementing in your library.

5 thoughts on “New MatchCount Configuration in SCOM 2012”

Hi Jonathan,
Thanks for this post. Reading this, I realize that I can generate a service monitor which will change its health state only after x number of times(which we can provide through override) the service stop condition is detected, however, I am not sure how can I implement this in my existing service monitors. Could you please provide an example of how this can be used in a service monitor?

Hi. How do we expose this new monitor type? Once imported into VSAE, I can use this monitor type to create a monitor, but I don’t know what to put in the configuration. Should this new monitor type be exposed in the Console now? Many Thanks

Hello Jonathan, I try to use the MatchCount on a custom Log monitor and it’s didnt Work. i use some module from NiceLog MP. all my condition Module Working. I can flip the monitor from healty to Warning ant to Error with the matchcount set to 1. When i set the matchcount to 2 or more it’s didn’t work. I Need some Help Pls.